Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

VPN Tunnel traffic on ASA 5510

I need to keep track of the bytes transmitted through a site-to-site tunnel each month on a Cisco ASA5510. The statistics can be seen via ASDM, but of course they get cleared each time the tunnel is reset. Does anybody have a method for keeping historical traffic through a tunnel?

Find more posts tagged with

Accepted answers

All comments

njoylif

ah, this is an age old issue for me as well. I am simply trying to monitor those tunnels (IPSEC only) and can't seem to get it down...the tunnel ID changes after the lifetime expires, and gens a new tunnel...eagerly awaiting insight - if there is a way
Sadly, I think i'd have to code something to get that to work.

Thanks all.

rcrespi

Not sure if you have already resolved this issue since it's been a while with no response. But have you taken a look at using the Orion device poller for the following MIBS

cikeTunInOctets - The total number of octets received by this IPsec Phase-1 IKE Tunnel OID - 1.3.6.1.4.1.9.9.171.1.2.3.1.19

cikeTunOutOctets - The total number of octets sent by this IPsec Phase-1 IKE Tunnel.- OID - 1.3.6.1.4.1.9.9.171.1.2.3.1.27

When you setup a universal device poller you can select to keep historical data.

njoylif

yea, problem with that is [on Cisco gear] the IPSEC tunnel ID changes every 3 days or so depending on your settings, so given a peer, you can't automatically keep track of its tunnel over extended time without having to manually discover which OID goes to which tunnel for the given peer.

Juniper routers treat IPSEC tunnels as a virtual interface - so you can manage it in Orion easily.

FYI

Donald_Francis

Are these split tunneled? Would just monitoring the outside interface not do it for you?

njoylif

That wouldn't do it for our purposes because these are "head end" devices connecting many tunnels/remotes into our extranet.

thanks though.